refactor: convention cleanup (comments, sealing, CancellationToken)

[andregoepel]

Summary

• Deleted narrative/decorative comments and dead commented-out code (ServiceDefaults' Aspire scaffolding, Initialization.cs, a handful of Razor pages), and stripped XML doc comments from internal/private members, keeping XML docs only on genuinely public API surface.
• Fixed a malformed doc-comment bug in Initialization.cs: two stacked <summary> blocks were both attached to EnsureKeyRingProtected, leaving BuildForwardedHeadersOptions undocumented. Reattached (and, per the internal-doc-stripping rule, compressed to a one-line comment).
• Replaced default(TValue) with bare default in ErrorComponentContext.cs; the direct replacement was ambiguous between ValueTask<T>'s two constructors, so it uses a named result: argument to disambiguate.
• Sealed SendEmailMessageHandler, MailConfiguration, MailMessage, and 28 test classes with no subclassers (verified via repo-wide grep before sealing each). Left SmtpEmailSender and LocalizedComponentBase unsealed as intended.
• Converted DataProtectionKeyDocument to a sealed record; the Marten document alias is set explicitly (DocumentAlias("dataprotectionkeydocument")), so the storage contract is unaffected either way.
• Threaded CancellationToken through SendEmailMessageHandler.Handle into IEmailSender.SendAsync, and updated its tests accordingly.
• Removed two redundant explicit StateHasChanged() calls in Setup.razor's OnValidSubmit handlers, matching the pattern already used in EmailSettingsPage.razor.
• Added missing // Arrange / // Act / // Assert comments to the 9 flagged tests.

AppPageTitle investigation (item 8)

The audit's concern — that AppPageTitle from AndreGoepel.Design.Blazor might never actually render <PageTitle>/set the browser tab title — does not hold up. The component's source (both on design-blazor's main and at the v1.4.2 tag pinned in this repo's Directory.Packages.props) contains <PageTitle>@DocumentTitle</PageTitle>, the framework's own component. The compiled AndreGoepel.Design.Blazor.dll (v1.4.2, from the local NuGet cache) does contain a PageTitle string reference in its metadata, confirming the Razor compiler emitted a reference to the framework type — the audit's binary inspection apparently missed it or checked the wrong artifact. HeadOutlet/HeadContent/document.title are correctly absent from this library's DLL: that's a host-app concern (wired in App.razor's <HeadOutlet />), not something a Razor class library needs to reference, and the sample host app has it configured correctly. No code changes were made in design-blazor — that stays out of scope for this task, but the human maintainer can now close out that audit finding as a false positive.

Test plan

• dotnet csharpier format .
• dotnet build — succeeds, no new warnings/errors (2 pre-existing nullable warnings in test files untouched by this change)
• dotnet test --filter "FullyQualifiedName!~E2ETests" — 29 + 84 passed, 0 failed
• dotnet list package --vulnerable --include-transitive — no vulnerable packages

Closes #137

🤖 Generated with Claude Code